Overview

overview

8

Static

static

1

Procmon.exe

windows10-2004-x64

8

Procmon64.exe

windows10-2004-x64

8

Procmon64a.exe

windows10-2004-x64

procmon.chm

windows10-2004-x64

1

Resubmissions

28-04-2024 19:57

240428-ypq4cafg35 8

28-04-2024 19:57

240428-yn71gaff99 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ProcessMonitor.zip

  • Size

    3.3MB

  • Sample

    240428-yn71gaff99

  • MD5

    3ef2eedf8139b1f51d9561fd8f9fee9a

  • SHA1

    e6769c1ec6d7367a450e304d554470bb0413900f

  • SHA256

    b556dcac41dc01f7310936fbd57d202eaecd00ff580398957b7125fd404728ae

  • SHA512

    4b1479914fdcddc94846ab6cde66976a61a04f8475e59970cb24b5583c40997d9f19eba81016ef69297d87779bb333b9f6d34357b9fdbfdb39448a1a85b36f00

  • SSDEEP

    98304:K6FoCGKZsQnafN/FqpbX/893Sxv8RE/6DdHrloE55PHAKZo:K6FnG4syes9/88xvh6hHrKE55IKu

Score
8/10
persistence

Malware Config

Targets

    • Target

      Procmon.exe

    • Size

      5.0MB

    • MD5

      2804ca9fc56e6c600418e1616ab2335d

    • SHA1

      ae4065ebf9b038be275efbff56793d1f4e77b79c

    • SHA256

      cfac057c0c811caa0ffa8581b7e7e7a2b1c6f3ce8a2ec1d05151a0a2b7dd173e

    • SHA512

      23b68a92c15c670ac627937c769d2a6ce0b8a17dc02f9bbc2a42df3aebb8314968c04864928ebf87df8dd37408e5d71ccab594e0212048badd11a671c29de329

    • SSDEEP

      98304:JLHG9k71Z7cxhVaSR+i5y1xn7j55y1NwHBdzYu8Y/IqRfNocBjsP70wAdlHBdzYB:JL+A1FjntHBjXeDAdlHBj

    Score
    8/10
    persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

    • Target

      Procmon64.exe

    • Size

      2.6MB

    • MD5

      6b3a6712990ed09dd166c281ec7bee30

    • SHA1

      8a85f03252d045009ce0b90adaac537e17f89167

    • SHA256

      a1b8c40f6da56961081dfee34a252fc667d22c7a22f30269d51f3f409111e787

    • SHA512

      d1baa1f83ab6fc37d939d8db74ba825507e53dc9fc0fa07c5957fccdabc05cc50f66e0db85b54478805e5aef9e1a8f14b262a4b68f43c8a8b62a089dc7be6a44

    • SSDEEP

      49152:sFlh/X+6cIqRfNoca4jsUNcj70wFOZd4CtBTNdzYu8D:aY/IqRfNocBjsP70wAdlHBdzYuK

    Score
    8/10
    persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence
    behavioral2

    • Target

      Procmon64a.exe

    • Size

      2.6MB

    • MD5

      d39a421255285914ce605550339a2fee

    • SHA1

      16264826332e20cba6402a04909516a52dc5f9e4

    • SHA256

      8355a41212e7a1a70274cfae5b2eda2e4e2dacbd3ea12cd4d5d1da6afbec2bc0

    • SHA512

      a86e2979dde4aba7869422869276d0f86ef83521058dfe1fdd1e591cc605e0b43c160b713dfa699450d4480f7a0b2564bfa3925befb92bb0a4fc530d44ec9806

    • SSDEEP

      24576:Ct7vUfL/45U350kKQLE4ZtNyP/Y+LXotBcMNdzY1A3uHgFlA:Ct7vUfLdOkflyfotBTNdzYu20lA

    Score
    1/10
    behavioral3

    • Target

      procmon.chm

    • Size

      62KB

    • MD5

      713906de48013c249228d5ff19e333eb

    • SHA1

      dd3bb7d17ed0cdbb2696d0edcad608e1e297b315

    • SHA256

      9d9c7e0160537263c60c6ac0941e63f08fce23431aa4eb19acd25ee1e2be20ee

    • SHA512

      e40b2291b83584d0f0de624aada522805e260694ef66d48260cc472341feb108ca4d3256327386cfd956f8201dca53e095a47c7047ea8e0b54186577cf7d18e4

    • SSDEEP

      1536:PSTpJ9kUpFxvOoIAsWszoKZNZX+xzWmKS01vzWF2JI3ksF/S:yvLOoIA7BKfZOkmE1zk2J9x

    Score
    1/10
    behavioral4

MITRE ATT&CK Enterprise v15

Tasks